Guides
In-depth guides
Longer walkthroughs for specific setups: real screenshots, code you can paste and the reason behind every step. The short fix page for each check lives under Learn.
All guides
25 guides, page 1 of 3.
- Security13 min read
Backups that actually restore: a small-site backup plan you can test
A backup you have never restored is a hope. Decide what to copy, how often and where, script it with wp-cli and rclone or a plugin, keep it out of the web root, and test the restore once a quarter.Updated 25 Sept 2026 - Security10 min read
Certificate chain errors: why it works in Chrome and fails elsewhere
A missing intermediate certificate hides in desktop browsers and breaks apps, curl, webhooks and crawlers. Read the chain, match the error to its cause and install the full chain on any server.Updated 25 Sept 2026 - Security13 min read
Certificate expiry: automate renewal, then monitor it
Public TLS certificates now last 200 days at most and 47 by 2029, so renewal has to be automatic. How each renewal stack works, the five ways it fails silently, and how to hear about it first.Updated 25 Sept 2026 - Security10 min read
Content-Security-Policy: from report-only to enforced
Roll out a Content-Security-Policy without breaking checkout, analytics or embeds. Inventory sources, run report-only, read the reports, then enforce with nonces or hashes instead of unsafe-inline.Updated 25 Sept 2026 - Security10 min read
Cookie flags explained: Secure, HttpOnly and SameSite
What Secure, HttpOnly and SameSite do, which attack each one stops, which of your cookies need which flag, and how to set them in PHP, Express, nginx, Apache and WordPress.Updated 25 Sept 2026 - Security11 min read
CORS wildcards: when Access-Control-Allow-Origin: * is dangerous
A wildcard CORS header is fine on fonts and public JSON, and a data leak on anything that answers differently per visitor. What CORS controls, the truly dangerous pattern, and safe allowlists.Updated 25 Sept 2026 - Security10 min read
Directory listings and exposed files: .env, .git and backups
An "Index of /" page or a readable .env file hands database passwords and source code to the first scanner that asks. What leaks, how the report probes for it, and the server rules that close it.Updated 25 Sept 2026 - Security12 min read
Flagged by Google Safe Browsing: what it means and how to clear it
A red "Deceptive site ahead" warning stops almost every visitor. See why Google flagged the site, how to find the cause, clean it in the right order and get the warning lifted with a review request.Updated 25 Sept 2026 - Security11 min read
HSTS: enabling it safely and joining the preload list
Turn on Strict-Transport-Security without locking anyone out, raise max-age in three stages, and decide whether the browser preload list is worth a commitment that is hard to undo.Updated 25 Sept 2026 - Security13 min read
Is my website hacked? Cloaking, spam links and Google-only redirects
Google shows pharma or Japanese text for your site, but your browser shows a clean page. See what Googlebot sees, confirm it by hand and clean a hacked WordPress site step by step.Updated 25 Sept 2026 - Security10 min read
Mixed content: finding and fixing http:// leftovers after HTTPS
Moved to HTTPS and lost the padlock, a stylesheet or a slider? Find every http:// resource the page still loads, fix it at the source in the database and theme, and add a safety net for the rest.Updated 25 Sept 2026 - Security12 min read
Outdated CMS versions: reading the generator tag and updating safely
The generator tag tells every scanner which WordPress, Joomla or Drupal version you run. How the report reads it, what out of date means, and a safe update routine for core, themes, plugins and PHP.Updated 25 Sept 2026
Guides tell you how. Your report tells you what.
Run a free report to see which of these guides apply to your site.